A financial company separates its auditing workloads in Subnet A (10.0.1.0/24) and product… — AWS Certified Solutions Architect - Associate

A financial company separates its auditing workloads in Subnet A ( $10.0.1.0/24$ ) and production workloads in Subnet B ( $10.0.2.0/24$ ) within the same VPC. Security regulations dictate that auditing instances in Subnet A must be allowed to initiate SSH connections (port 22) to production workloads in Subnet B. However, production workloads must be prevented from initiating any connection back to the auditing workloads. To provide defense-in-depth, the network architect must configure Network Access Control Lists (Network ACLs) on both subnets to permit only this specific traffic flow and its return packets. Which configuration of Network ACL rules for Subnet A and Subnet B will correctly allow the auditing traffic while following the principle of least privilege?

A
Subnet A: Outbound rule allowing TCP port 22 to $10.0.2.0/24$ with no inbound rules. Subnet B: Inbound rule allowing TCP port 22 from $10.0.1.0/24$ with no outbound rules.
B
Subnet A: Outbound rule allowing TCP port 22 to $10.0.2.0/24$ , and Inbound rule allowing TCP port 22 from $10.0.2.0/24$ . Subnet B: Inbound rule allowing TCP port 22 from $10.0.1.0/24$ , and Outbound rule allowing TCP port 22 to $10.0.1.0/24$ .
Subnet A: Outbound rule allowing TCP port 22 to $10.0.2.0/24$ , and Inbound rule allowing TCP ports 1024-65535 from $10.0.2.0/24$ . Subnet B: Inbound rule allowing TCP port 22 from $10.0.1.0/24$ , and Outbound rule allowing TCP ports 1024-65535 to $10.0.1.0/24$ .Cevap
D
Subnet A: Inbound rule allowing TCP port 22 from $10.0.2.0/24$ , and Outbound rule allowing TCP ports 1024-65535 to $10.0.2.0/24$ . Subnet B: Outbound rule allowing TCP port 22 to $10.0.1.0/24$ , and Inbound rule allowing TCP ports 1024-65535 from $10.0.1.0/24$ .

Cevap

Subnet A: Outbound rule allowing TCP port 22 to

10.0.2.0/24

, and Inbound rule allowing TCP ports 1024-65535 from

10.0.2.0/24

. Subnet B: Inbound rule allowing TCP port 22 from

10.0.1.0/24

, and Outbound rule allowing TCP ports 1024-65535 to

10.0.1.0/24

Network ACLs are stateless network-filtering boundaries. When an EC2 instance in Subnet A initiates an SSH connection to an EC2 instance in Subnet B, the outgoing request leaves Subnet A on port 22 and reaches Subnet B on port 22. Thus, Subnet A needs an outbound rule for port 22, and Subnet B needs an inbound rule for port 22. The return packets from Subnet B are sent from port 22 back to the ephemeral port range (1024-65535) allocated by the client in Subnet A. Because Network ACLs do not automatically track session state, Subnet B must have an outbound rule to allow traffic to the ephemeral ports of Subnet A, and Subnet A must have an inbound rule to allow traffic on the ephemeral ports from Subnet B.

Adım Adım Çözüm

Analyze the direction of the initiation flow.

The connection is initiated from Subnet A (source) to Subnet B (destination) on TCP port 22.

This establishes that Subnet A needs outbound TCP port 22 allowed, and Subnet B needs inbound TCP port 22 allowed.

Determine return traffic behavior for stateless firewalls.

Network ACLs are stateless, meaning the returning traffic must be explicitly allowed in the reverse direction.

Because the SSH client allocates an ephemeral port (typically 1024-65535) to receive the response, the return traffic flows from Subnet B's ephemeral ports back to Subnet A's ephemeral ports.

Formulate the exact inbound and outbound rules for both subnets.

Subnet A needs outbound port 22 and inbound ephemeral ports 1024-65535. Subnet B needs inbound port 22 and outbound ephemeral ports 1024-65535.

This guarantees that the initial request and the response packets are both permitted through the stateless boundaries of both subnets.

Anahtar Kavram

VPC Network Security and Stateless Network ACL Rules

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru